php - Whose temporary directory an upload script uses? -

i building upload feature on project.i have done other validation on exist,size , type there little more validation needed.i found out mime validation no matter file extension user upload checks real file type.below code did work me.now whenever user try upload .php file .png/jpg/jpeg or other fake extension name code catches malicious file type.but have question when user upload file @ first goes on temporary directory.is temporary directory used client pc or our server?if our server malicious fake extension file can dangerous or not?

$imageinfo = getimagesize($_files['file']['tmp_name']);      if ($imageinfo['mime'] == ("image/png") || $imageinfo['mime'] == ("image/jpeg")             || $imageinfo['mime'] == ("image/jpg")) { 

from manual:

files will, default stored in server's default temporary directory, unless location has been given upload_tmp_dir directive in php.ini. server's default directory can changed setting environment variable tmpdir in environment in php runs.

the file deleted temporary directory @ end of request if has not been moved away or renamed.

---

unless intentionally stupid run files found within temporary directory, or cause them run, you're fine. it's not dangerous file exist short period of time deleted.